Data Retention Schedule
Effective: 2026-07-25
| Data category | Retention | Deletion |
|---|---|---|
| Active account & profile | While account is active | On company deletion request or 90 days after contract end |
| Reports, images, templates | While customer account is active | Company export + deletion API; storage objects removed with report/company delete |
| Authentication & security logs | 90 days | Automatic rotation |
| Backups (Cloud SQL PITR) | 7 days point-in-time | Automatic per provider policy |
| Email (password reset) | Provider default | Not stored in Aurovex application DB |
Customer-initiated deletion
Company administrators may request full tenant deletion via POST /api/governance/delete-company-data (authenticated, confirmation required) or by contacting privacy@aurovex.ca.